chore: quality hardening — security, tests, docs, knip, ESLint

[LucasSantana-Dev]

Summary

Comprehensive quality hardening across security, tests, documentation, dead-code elimination, ESLint, and pattern coverage.

Changes

Security (High)

• Fix high-severity flatted vulnerability via npm audit fix
• Zero vulnerabilities after fix

Critical Bug Fix

• VERSION constant drift: src/index.ts said 1.1.1, package was 1.11.0 — now reads 1.11.0
• Add test: VERSION must match package.json version to prevent future drift
• Update scripts/release-core.sh to auto-sync VERSION on every release

Coverage Fix (was blocking 80% gate)

• Add 26 unit tests for src/tenant/contract.ts — was at 37.5% function coverage, now 100%

Test Expansion (+42 tests, 493 → 535)

• Add 17 tests for policy-engine loader validation error paths
• Add security edge-case tests: prototype-pollution blocking, MAX_DEPTH, regex safety
• Add 22 governance assessor tests covering all 9 check paths
  • .cursorrules / copilot-instructions.md alternatives, .claude/skills/ checks
  • settings.json hook validation, SAST tool detection, gitguardian
  • Grade/score boundary tests (A for full compliance, D/F for critical failures)

Dead Code Elimination (knip)

• Add knip.json configuration: proper entry points, project scope, ignore rules
• Remove unnecessary export from MCP context server internals:
  STORE_DIR, ProjectEntry, ProjectMeta, ProjectResource, getContentPath, getMetaPath, findResourceByProject
• Declare IDP CLI files as knip entry points
• Result: 0 unused files/exports/types (was 31 files + 4 exports + 5 types)

ESLint Cleanup (92 → 7 warnings, 0 errors)

• Replace any types with unknown in shared-infrastructure logger (5 files)
• Fix unused vars across IDP migration, feature-toggles, plugin-system, scorecards
• Add jest globals to ESLint config (eliminates no-undef in .test.ts)

Maintenance

• Delete stale .github/workflows/reusable/release-detect.yml.bak
• Add patterns/ide-extensions/vscode/coverage/ and opencode.jsonc to .gitignore
• Fix .gitignore: scope coverage/ to root only (was blocking patterns/coverage/)
• Add Prettier config: *.jsonc to .prettierignore

Documentation (15 new READMEs — all 23/23 patterns now documented)

• patterns/idp/ — policy engine, scorecards, migration assessor, feature toggles, security spoke
• patterns/monitoring/, patterns/mcp-servers/, patterns/security/, patterns/mcp-gateway/
• patterns/code-quality/, patterns/coverage/, patterns/git/, patterns/config/, patterns/ai-tools/
• patterns/java/, patterns/localstack/

Metrics

Metric	Before	After
Tests	493	535
Coverage (functions)	66.66%	100%
ESLint issues	92	7 (warnings only)
Knip issues	40+	0
Security vulnerabilities	1 high	0
Pattern READMEs	13/23	23/23
VERSION accuracy	❌ 1.1.1	✅ 1.11.0
Build	✅	✅
validate gate	❌ Failing	✅ Passing

[coderabbitai]

Warning

Rate limit exceeded

@LucasSantana-Dev has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 10 minutes and 26 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bfc47ad5-12c5-4873-9ab0-0942513a94b0

📥 Commits

Reviewing files that changed from the base of the PR and between f154e1e and a0db9a2.

📒 Files selected for processing (36)

• .gitignore
• .prettierignore
• eslint.config.js
• patterns/ai-tools/README.md
• patterns/code-quality/README.md
• patterns/config/README.md
• patterns/coverage/README.md
• patterns/coverage/codecov.template.yml
• patterns/coverage/coverage-standards.md
• patterns/coverage/jest.config.template.js
• patterns/feature-toggles/libraries/advanced/index.js
• patterns/git/README.md
• patterns/idp/README.md
• patterns/idp/__tests__/migration-assessor.test.ts
• patterns/idp/__tests__/policy-engine.test.ts
• patterns/idp/migration/cli.ts
• patterns/idp/migration/collectors/ai-governance-assessor.ts
• patterns/idp/migration/collectors/architecture-assessor.ts
• patterns/idp/migration/collectors/quality-assessor.ts
• patterns/idp/policy-engine/builtin-functions.ts
• patterns/idp/scorecards/collectors/base-collector.ts
• patterns/idp/security-spoke/index.ts
• patterns/mcp-gateway/README.md
• patterns/mcp-servers/README.md
• patterns/monitoring/README.md
• patterns/monitoring/shared-logger.ts
• patterns/plugin-system/examples/feature-enhancer-plugin.js
• patterns/security/README.md
• patterns/shared-infrastructure/logger/config/index.ts
• patterns/shared-infrastructure/logger/src/logger.ts
• patterns/shared-infrastructure/logger/src/observability.ts
• patterns/shared-infrastructure/logger/src/transports.ts
• patterns/shared-infrastructure/logger/src/types.ts
• src/import-side-effects.test.js
• src/index.test.js
• src/tenant/contract.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/quality-hardening

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Project Scorecard

Scorecard: 84/100 (B)
────────────────────────────────────────
  security: 100/100 (A)
  quality: 80/100 (B) — 1 violations
  performance: 67/100 (D) — 1 violations
  compliance: 75/100 (C) — 1 violations
  dependency: 100/100 (A)

Recommendations:
  - Increase test coverage to meet the 80% threshold
  - Extend log retention to at least 90 days for compliance

[sonarqubecloud]

Quality Gate failed

Failed conditions
25.9% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud